PT-2019-4669 · Ie · Ie/Wsn-Pa Link Wirelesshart Gateway

Published 2019-09-10 · Updated 2019-09-24 · CVE-2019-13923

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IE/WSN-PA Link WirelessHART Gateway (All versions)

Description The issue is related to the implementation of the WirelessHART protocol in the IE/WSN-PA Link gateway, specifically concerning the lack of protection for the web page structure. This could allow a remote attacker to perform cross-site scripting (XSS) attacks. For a successful exploitation, user interaction is required, and the user must be logged into the web interface. At the time of publishing, no public exploitation of this issue is known.

Recommendations For all versions, to mitigate the risk of cross-site scripting attacks, consider restricting access to the integrated configuration web server until a fix is available. Additionally, avoid accessing suspicious or malicious links while logged into the web interface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2020-00862

CVE-2019-13923

Affected Products

Ie/Wsn-Pa Link Wirelesshart Gateway

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-191683.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13923 · Security Note
• https://bdu.fstec.ru/vul/2020-00862 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-253-04 · Note